SC-34 Non-modifiable Executable Programs
System and Communications Protection
Description
For [Assignment: organization-defined system components], load and execute: a. The operating environment from hardware-enforced, read-only media; and b. The following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications].
Supplemental Guidance
The operating environment for a system contains the code that hosts applications, including operating systems, executives, or virtual machine monitors (i.e., hypervisors). It can also include certain applications that run directly on hardware platforms. Hardware-enforced, read-only media include Compact Disc-Recordable (CD-R) and Digital Versatile Disc-Recordable (DVD-R) disk drives as well as one-time, programmable, read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable, read-only memory can be accepted as read-only media provided that integrity can be adequately protected from the point of initial writing to the insertion of the memory into the system, and there are reliable hardware protections against reprogramming the memory while installed in organizational systems.
Changes from Rev 4
No significant title changes from Rev 4.
Enhancements (2)
What NIST adds to this control. Select one to read its statement.
SC-34(01) No Writable Storage
Employ [Assignment: organization-defined system components] with no writeable storage that is persistent across component restart or power on/off.
SC-34(02) Integrity Protection on Read-only Media
Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media.
Withdrawn by NIST:
- SC-34(03) Hardware-based Protection, now in SC-51
MITRE ATT&CK Techniques (15)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.